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Abstract 


The physical and combustion properties of hydrogen give rise to hazards that must be considered 
when designing and operating a hydrogen system. One of the major concerns in the use of hydrogen 
is that of fire or detonation because of hydrogen’s wide flammability range, low ignition energy, and 
flame speed. Other concerns include the contact and interaction of hydrogen with materials, such as 
the hydrogen embrittlement of materials and the formation of hydrogen hydrides. The low 
temperature of liquid and slush hydrogen bring other concerns related to material compatibility and 
pressure control; this is especially important when dissimilar, adjoining materials are involved. The 
potential hazards arising from these properties and design features necessitate a proper hydrogen 
hazards analysis before introducing a material, component, or system into hydrogen service. 

The objective of this guide is to describe the NASA Johnson Space Center White Sands Test 
Facility hydrogen hazards analysis method that should be performed before hydrogen is used in 
components and/or systems. The method is consistent with standard practices for analyzing hazards. 

It is recommended that this analysis be made before implementing a hydrogen component 
qualification procedure. A hydrogen hazards analysis is a useful tool for hydrogen-system designers, 
system and safety engineers, and facility managers. A hydrogen hazards analysis can identify 
problem areas before hydrogen is introduced into a system — preventing damage to hardware, delay or 
loss of mission or objective, and possible injury or loss of life. 

This guide is based on information from the NASA Safety Standard for Hydrogen and Hydrogen 
Systems (NSS 1740. 16) and experience derived from the development of a similar protocol for oxygen 
system hazards analysis. It was previously published as TP-WSTF-937 (Woods 1998). 
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1.0 Introduction 

Hydrogen shall be stored, handled, and used so that life and health are not jeopardized, the risk of 
property/equipment damage is minimized, and the mission of the system/equipment is sustained. This 
guide provides a method (Stoltzfus 1996, Woods 1998) by which contributing factors are reviewed 
and scenarios representative of hazards are considered. 

The puipose of this guide is to describe the NASA Johnson Space Center White Sands Test 
Facility (NASA JSC WSTF) hydrogen hazards analysis method that should be performed before 
hydrogen is used in components and/or systems. This analysis is in accordance with the requirements 
and guidelines inNSS 1740.16, NASA Safety Standard for Hydrogen and Hydrogen Systems, and the 
method is consistent with standard practices for analyzing hazards. It is recommended that this 
analysis be made before implementing a hydrogen component qualification procedure. A hydrogen 
hazards analysis is a useful tool for hydrogen-system designers, system and safety engineers, facility 
managers, and those tasked with accident analysis. A hydrogen hazards analysis can identify problem 
areas before hydrogen is introduced into a system — preventing damage to hardware, delay or loss of 
mission or objective, and possible injury or loss of life. 

This guide addresses gaseous and liquid hydrogen but does not specifically address all the hazards 
associated with other forms of hydrogen, such as slush. 

Recommendations, guidelines, standards, and mandatory requirements for the safe design, 
installation, operation, and maintenance of a hydrogen component, system, or facility are presented in 
other documents (NSS 1740.16, NSS 1740.12, NFPA 50A, NFPA 50B, 29 CFR 1910.103, ASME 
2001, ASME 2002). 

2.0 Objective 

The objective of this guide is to describe a hydrogen hazards analysis method that should be 
performed before hydrogen is used in components and/or systems. The widespread uses of hydrogen 
in the future will benefit from applying a rigorous, comprehensive hazards analysis method such as 
the one described in this guide. 

3.0 Hazards 

Proper design and operation of hydrogen systems allow for control of the potentially hazardous 
environments and chemical properties associated with hydrogen. Any event involving hydrogen that 
creates a condition that could result in one or more of the following is considered a hazard: (1) injury 
to people; (2) damage to property or equipment; and (3) delay or loss of a mission or objective. A 
hazard results from the occurrence of a particular set of contributing factors that make up a scenario. 
Hence, hazards arise from how hydrogen is used and are not intrinsic to hydrogen itself. Hydrogen’s 
combustion and physical properties must be considered. When it is used in a system, further 
questions arise concerning potential pressure releases such as blast, overpressure, stored energy, and 
boiling liquid expanding vapor explosions. The phases present in the system lead to temperature 
considerations. At low temperatures, it is important to consider cold fluids handling, cryopumping, 
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contaminant solidification, cold surfaces, oxygen enrichment of air, and cold embrittlement of 
containment and nearby materials. Hydrogen embrittlement of metals must be considered. 
Operations that involve personnel give rise to potential health issues, including bums (from direct 
contact with flame or hot surfaces, cryogens, or radiation exposure); asphyxiation (from hydrogen or 
purge gases such as nitrogen or helium); hypothermia; blast (overpressure) injury; or injury from 
fragments. 

3.1 Combustion Hazard 

Hydrogen is flammable. Therefore, fire is a primary hydrogen hazard if the consequences of the 
fire include: (1) injury of personnel; (2) damage to equipment/property; and (3) delay or loss of 
mission or objective. A fire can result from the following scenarios. 

• Hydrogen is released, mixes with an oxidizer, and forms a combustible mixture. The mixture 
contacts an ignition source and ignition occurs. 

• The hydrogen system is contaminated with an oxidizer as a result of improper purging and/or in 
leakage of an oxidizer, such as air. The hydrogen and the oxidizer form a combustible mixture, 
the combustible mixture contacts an ignition source, and ignition occurs. 

• Hydrogen or an oxidizer leak from one part of a system into another part of the system where a 
combustible mixture is formed and ignited. 

This guide will focus on the fire and explosion hazards as the basic hazards for assessment. 

3.2 Pressure Hazard 

Hydrogen has a significant expansion ratio in its conversion from a liquid at normal boiling point 
to a gas at normal temperature and pressure; therefore, overpressure is another hydrogen hazard to be 
considered. Overpressure can result in: 

• Excessive deformation and subsequent release of hydrogen. 

• Rupture of the pressure vessel, which would release hydrogen (this could provide the ignition 
source) and/or produce projectiles from vessel fragments. 

Gaseous hydrogen is compressible, and a compressed gas can have a significant potential energy. 
Therefore, this is another pressure hazard to be considered. 

3.3 Hydrogen-Related Injuries 

Potential hydrogen-related accidents and injuries are described below. 

Asphyxiation. Asphyxiation can result if hydrogen or inert gases used for purging a hydrogen 
system displace the oxygen in a breathing atmosphere. 

Blast Overpressure. Blast overpressure can result from a detonation or from the unconfined 
expansion of a compressed gas. 

Burn. A burn can result from direct contact with a hydrogen fire, thermal radiation from a 
hydrogen fire, or contact with a surface that has been heated by a hydrogen fire. 
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Fragments. An explosion can produce fragments from the container of an explosive mixture or 
from structures or other items near the explosion. These fragments can result in injury or death to 
personnel, and damage or destruction of equipment. 

Frostbite (Freezing, Cryogenic Burn). Frostbite can result from contact with a cold fluid or a cold 
surface. 

Hypothermia. Hypothermia can occur if the body temperature is lowered as a consequence of a 
cold environment, such as from a liquid hydrogen spill. 

Most hydrogen systems isolate personnel from direct exposure to hydrogen. For example, we 
mitigate frostbite danger from liquid hydrogen by using personal protective equipment and with 
proper equipment insulation and barriers. 

4.0 Procedure 

The procedure for conducting a hydrogen hazards analysis is described in this section. Figure 1 
provides an outline of this procedure. The procedure examines in detail all components exposed to 
hydrogen, analyzes likely failure modes, determines the consequence(s) of a particular change to the 
system, and qualitatively assesses the risk for the system owners. At present, the procedure is 
primarily designed to address hydrogen combustion hazards. Preliminary activities are to adequately 
define the application and the scope of the investigation. Once defined, an analysis team with 
expertise in mechanical design, materials, ignition and combustion, safety, and component testing as it 
pertains to hydrogen, is assembled. Before convening analysis activities, detailed information on the 
components and the system to be analyzed is compiled as a report draft. Thoroughness at this point 
cannot be overemphasized; ease of the analysis process depends heavily on rigorous preparation. 

4.1 General 

A typical hazards analysis procedure begins with the system owners identifying the authorities that 
have jurisdiction over the system and what requirements and regulations must be met for its safe 
operation. A hazards analysis can be performed at any stage in the development of a system, but is 
preferably accomplished early on, particularly during the design phase. It can also be an effective tool 
for understanding hazards in an existing system. 

The analysis identifies possible hazards related to a component, system, or facility based on 
relevant hydrogen properties, materials of construction, operating conditions, and siting. The possible 
source(s) for each hazard and the possible cause(s) for each source are examined. For each hazard, 
the analysis identifies possible consequences and risks for employees and the public, property, and the 
overall operation. The analysis does not determine whether consequences are acceptable or not; what 
constitutes an acceptable risk is commonly determined at a higher management level in an 
organization. The analysis may recommend that the probability or severity of a particular hazard be 
minimized and may suggest a means to do so. 

Input to the hazards analysis is very important. One strength of the procedure is how it drives 
examination of all materials wetted with hydrogen in a systematic, component-by-component fashion. 
The usual approach is top-down, with the analyst(s) first considering what types of components and 
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materials might generally contribute to a hazard. One limitation of this approach is that it examines 
from the top-down perspective only, which can lead to unintended omissions when specific hazards 
are missed. The typical analysis begins by identifying possible component failures in much the same 
way that a failure modes and effects analysis (FMEA) does, except that the modes identified are 
limited to those that would create or be implicated in a hydrogen hazard. Therefore, an FMEA or 
similar document, along with an exact materials list and system and component drawings, are needed 
before the actual analysis can commence. Team members responsible for design and system function 
must have at their fingertips complete information regarding which materials (body, bellows, 
diaphragm, and soft goods) the component manufacturer uses, and how they are used within the 
component. Again, good record keeping and advance preparation are key to a successful analysis. 

To illustrate the level of detail needed, consider the following example of what happens when the 
analysis preparation is insufficient. Component parts such as electrical solenoids or electronics are 
sealed from hydrogen-wetted areas and from the outside environment. The probability of identifying 
a hazard increases in hydrogen systems if a single failure can lead to hydrogen accumulating in a 
component housing that also contains air and electrical ignition sources. When the information 
needed to evaluate such a scenario is not readily available, design teams are forced to call their 
support staffs to obtain this information, usually from vendors, and the analysis can come to a 
standstill. Typically, every design team encounters this situation during the analysis, and the 
downtime can be costly. However, the value accrued by the detailed analysis offsets the delay, and 
design teams have all remarked on the usefulness of a thorough analysis. 

For more complex systems, the hazards analysis procedure is evolving. The initial goal for the 
hydrogen hazards analysis team was to capture analysis rationale in the draft report as work 
progresses so that the team members would have a completed report in their hands at the close of 
work. The more complex a system is, however, the more time is required for preparation. Analysis 
and system design are often not fixed at the time the team is convened, and the analysis must continue 
even after the team is adjourned. 

Depending on the complexity of the hydrogen system to be analyzed, it is suggested to convene an 
advance party to familiarize key team members with the hazards analysis procedure, the hydrogen 
system function, pertinent data requirements, and to work out an analysis strategy to present to the full 
team. Components subject to potential design modifications should be identified. The process is 
greatly expedited if a detailed database of materials, components, and combustion data are available at 
this time for use in the hazards analysis. 

Another aspect of the system complexity challenge is the record keeping necessary to document 
system states, failures modes, dual-fault requirements, identified hazards, recommendations, 
equipment or component descriptions, and explanatory notes in a format that can be followed by the 
team and subsequently read by other analysts. The implications of a component failure vary with the 
system state, so a given component may require a separate analysis for each possible operational state. 
Dual-fault tolerance requirements introduce yet greater complexity. Currently, the report draft used 
by WSTF teams involves component data tables that rely on hyperlinks to relate the tabular data with 
explanatory endnotes. Recommendations made in the endnotes are also called out in a list 
conveniently located at the front of the document. The team recorder edits this document as the 
analysis proceeds. Team members constantly look for commonality in failure modes and effects 
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across different components to streamline the analysis. The analysis worksheets list hydrogen hazard 
considerations and ignition sources that are used as needed. The resulting document can be large and 
complex. How to handle this complexity from the applied perspective will continue to evolve as 
improvements are sought. 

The relationships among hazards analysis team members are important, as their functions are not 
identical and sometimes conflict. Design or system advocates may perceive an adversarial 
environment when design faults are uncovered or new requirements are created. System owners may 
feel ambivalent toward the analysis process when they realize the cost and schedule. There are 
sometimes hidden agendas between the designers and system owners, especially when designs may be 
perceived as flawed or where the analysis is being conducted to determine how a system failed. The 
effort proceeds by consensus, without which the hazards analysis cannot be completed. It is important 
to have an experienced, diplomatic team leader who keeps the focus on technical issues. 

Technical communication within a group can challenge the process. Current presentation and 
communications techniques, such as those encountered with the use of overheads and computer 
projectors, can be restrictive. The technical backgrounds of team members may be sufficiently 
different that misunderstandings can arise. Large groups can dissemble into separate discussions. 
Although these facts need to be recognized as necessary elements to the consensus process, those 
unfamiliar with the pace and apparent “confusion” may be somewhat frustrated. These are not 
insurmountable problems, but they are a factor in the success of the hazards analysis. An experienced 
team leader is an essential and vital force that keeps the team focused and moving forward. 

4.2 Define the Application 

Define the hydrogen application to be analyzed. 

4.3 Define Investigation Scope 

Define the scope of the investigation. 

4.4 Assemble Hydrogen Hazards Analysis Team 

When assembling a hydrogen hazards analysis team, consider the particular application to be 
analyzed and the scope of the investigation. The team shall include, at a minimum, personnel with 
expertise in mechanical design, materials, ignition and combustion, safety, and component testing 
(with emphasis on hydrogen systems). Depending on the system, personnel should also be included 
with expertise in electrical design, cryogenic fluids, and chemistry. The team members should 
represent the appropriate technologies involved in the analysis and should be familiar and experienced 
with hydrogen systems. A team leader should be appointed to direct team efforts, and a team member 
should record deliberations within the report format. Experts in materials and component design 
should participate as required to develop the information and data needed for the analysis. 

4.5 Compile Component/System Information 

Compile information on the system and the components in the system, including system 
configuration, technical specifications, materials involved, operational conditions, and operational 
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procedures. Obtain information and data on each component in the system, such as materials of 
construction (including soft goods and lubricants), cross-sectional drawings of each component 
(particularly fluid flow paths and the location of soft goods), and a system fluid schematic. 

Component cross sections are used to locate and identify all the soft goods. If the cross-sectional 
view of a component is of poor quality or unclear, an actual disassembled component complete with 
soft goods is useful. All materials of construction should be identified. The flow path should also be 
identified, along with all hydrogen-wetted materials. The material data for each component should be 
tabulated in the Component/System Material Summary Worksheet (Figure 2). 

Reasons for compliance or noncompliance with specific code requirements (Appendix A) must be 
assessed before conducting a hazards analysis on a hydrogen system. 

4.6 Identify Operating and Worst-Case Conditions 

Determine realistic worst-case operating environments and conditions for each component. The 
data for operating and worst-case conditions should be tabulated in the Operating and Worst-Case 
Environment Summary Worksheet (Figure 3). This information includes minimum and maximum use 
pressures, temperatures, and flow rates, and is used to evaluate the materials of construction for 
compatibility with hydrogen and operating conditions. The rate-of-change of operating conditions, 
such as temperature, shall also be determined. Temperature and pressure are important because a 
material’s hydrogen compatibility is often a function of these two parameters. Also, many material 
properties are temperature-sensitive. Flow rate is important because it has an affect on such concerns 
as particle impact and adiabatic compression. 

4.7 Assess Hydrogen Hazards 

The analysis team begins by reviewing the hazards analysis objectives and methodology. An 
overview of system design and operation is then presented. The inputs to this are system and 
component drawings, materials lists, and an FMEA. Operating and worst-case conditions are 
identified. Component design and function are examined to see if grouping them by failure type, 
failure effect, or subsystem, can streamline the analysis. The analysis proceeds for each component or 
subsystem in a given operational mode by identifying the nature of the failure, type of combustible 
mixture formed, potential ignition mechanisms, and whether fire, deflagration, or detonation can 
occur. Also considered are design features and administrative controls that may be used. Occurrence 
probabilities are assessed for each of these categories. The scenario posed by a given failure and the 
potential resulting combustion processes are evaluated to see what secondary effects may result. 
Assessing the overall risk to the system or its purpose completes the analysis at this level. The results 
are summarized and documented in the Hydrogen Hazards Analysis Chart (Figure 4). When 
necessary, supporting rationale is noted. 

To summarize, perform a hydrogen hazard assessment in accordance with the seven basic steps 
listed below, described in detail in the following sections, and outlined in Figure 1. Tabulate the 
results of the assessment in the Hydrogen Hazards Analysis Chart. 

Step 1 List all system components. 

Step 2 Determine if failure of each component is possible. 
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Step 3 Determine if a combustible mixture can form if the component fails. 

Step 4 Determine if an ignition source is present. 

Step 5 Determine the probability of consequences such as fire, deflagration, and detonation. 

Step 6 Analyze secondary effects. 

Step 7 Assess the reaction effects. 

Analysis scores are determined by team consensus and are tallied through a qualitative rating 
scheme. This rating may be based in part on quantitative analysis, but it also relies on experience and 
intuition. Published sources used in the analysis include: Safety Standard for Hydrogen and 
Hydrogen Systems (NSS 1740. 16); Safety in the Handling of Cryogenic Fluids (Edeskuty 1996); the 
Sourcebook for Hydrogen Application (TISEC 1998); Ignition and Thermal Hazards of Selected 
Aerospace Fluids (Benz 1988); and current combustion literature. The rating scheme, used in the 
assessment of the first four steps, is based on a qualitative probability rating of 0 through 4. The 
score, negotiated among team members, is based on their experience. The following probability 
ratings shall be used in Steps 2 through 5 of the procedure: 

0 = Almost Impossible 

1 = Remote (tested and shown to be compatible with hydrogen and operating conditions) 

2 = Possible 

3 = Probable 

4 = Highly Probable 

The estimates made by assigning one of these probability ratings are quite imprecise and generally 
subjective, but they do create a basis for evaluating applications by helping to focus on the most 
important issues. 

The results tabulated in each step are read as independent assessments of probability rather than as 
interrelated. Analysis places the failure of the individual component not only in the context of its 
function in the subsystem or system but also in its functional environment. This is important for 
hydrogen, which may leak from one component, accumulate elsewhere, and be subjected to ignition 
sources and confinement criteria that vary throughout the entire system. When necessary, the 
interaction among components may be evaluated in a matrix fashion. Analysis may also be driven by 
fault-level requirements. The final risk assessment given for the reaction effect, Step 7, is not read as 
a result derived by “multiplying” the probabilities assessed in Steps 2 through 5 of the procedure, but 
is an assessment of the overall effect on personnel, the system, or its mission, caused by the particular 
failure mode of the component under consideration. 

The analysis proceeds through all the system components. Recommendations are recorded as they 
become apparent from analysis. During team deliberations the analysis, supporting rationale, and 
recommendations are recorded into the draft report by the team member acting as recorder. The 
objective is to have a draft report when the team is finished. After review, a final report is prepared 
for the system owners. Where needed, the report provides recommendations for testing, component 
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redesign, materials replacement, and the identification of procedural controls. The risks identified in 
the hazards analysis are then available for review by appropriate upper management review teams. 

4.7.1 Step 1 

List all components of the hydrogen system being analyzed in column 1 of the Hydrogen Hazards 
Analysis Chart (Figure 4). The components may be sorted by subsystem. 

4.7.2 Step 2 

Use the Causes Evaluated Worksheet (Figure 5) to examine each component for the characteristics 
listed below and consider the complete range of operating environments to which the component will 
be exposed. 

(1) Examine catastrophic and noncatastrophic failure modes. 

(2) Ensure suitable materials are used in each component such that they safely perform as expected. 
The physical and chemical interaction of hydrogen with the materials in each component, the 
possible operating conditions for each component, and the interaction of hydrogen with the 
system configuration should be considered. 

(3) Evaluate component/system operating conditions. Some conditions are not conducive to an 
unplanned release of hydrogen or contamination of the hydrogen system/equipment with an 
oxidizer (air, for example). 

(4) Confirm that design features of the component/system are adequate to prevent an unplanned 
release of hydrogen or contamination of the hydrogen system/equipment with an oxidizer (air, for 
example). 

(5) Determine if control features/functions are adequate such that the system will safely operate. 

Determine at the start if any of the causes given in Figure 5 can be eliminated, or if there are other 
causes that should be added. 

Appendix B contains a discussion of relevant failure modes, applicable material properties, 
component/system operating considerations, design features, and control functions applicable for the 
Causes Evaluated Worksheet (Figure 5). 

Transfer a summary of the results from the Causes Evaluated Worksheet to columns 2 through 4 of 
the Hazards Analysis Chart. If needed, replace “Other” in column 4 with a specific failure mode and 
add additional columns as needed to identify specific failure modes that are considered essential to 
the hazards analysis. 

4.7.3 Step 3 

Evaluate each component to determine if a failure (as determined in Step 2) will allow a 
combustible mixture to form, and enter the results in columns 5 through 8 of the Hazards Analysis 
Chart. The complete range of operating environments to which the component will be exposed must 
be considered. 
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In hydrogen systems, combustible mixtures are typically formed as a result of hydrogen leaking 
into an air environment (external leakage); air leaking into a hydrogen environment (in leakage); or 
hydrogen (or oxidizer) leaking from one part of a hydrogen system into another part. Material failures 
are a predominant source of external or internal leakage, but all failure modes described in Step 2 
should be considered. 

If needed, replace “Other” in column 8 with a specific event that could lead to the formation of a 
combustible mixture. Add additional columns as needed to identify specific events that could lead to 
the formation of a combustible mixture. This is essential in the hazards analysis. 

4.7.4 Step 4 

Next, use the Ignition Sources Worksheet (Figure 6) to do an ignition mechanism survey. Possible 
ignition sources must be evaluated for each component for which a failure mode is identified and for 
which a combustible mixture is possible. The objective of this assessment is to determine if there is 
an ignition source present within the extent of a combustible mixture and if that ignition source could 
ignite the mixture that was produced by the failure of a component. A discussion of potential ignition 
sources applicable for using the Ignition Sources Worksheet is given in Appendix C. 

Enter the ignition sources survey results into columns 9 through 12 of the Hazards Analysis Chart. 
The amount of energy involved in an ignition source should be considered because this is an 
important factor in determining if a detonation is possible. 

If needed, replace “Other” in column 12 with an ignition source specific to the system being 
assessed that could ignite a combustible mixture. Insert additional columns as needed to identify 
specific ignition sources that are essential to the hazards analysis. 

4.7.5 Step 5 

The probability of consequences such as fire, deflagration, and detonation must be assessed and 
the results entered into columns 13 through 16 of the Hazards Analysis Chart. 

System characteristics such as volume and turbulence shall be considered in this step. Some 
specific concerns include: 

• Can a combustible mixture accumulate in a confined space? 

• If so, how large is the confined area? 

• Is the area sufficiently large that a detonation could occur (that is, is there sufficient volume for 
the cells)? 

• Are there obstacles within the volume such that a flame would experience turbulence? 

If needed, replace “Other” in column 16 with a specific consequence that could occur, and add 
additional columns as needed to identify other specific consequences that could occur that are 
essential to the hazards analysis. 
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4.7.6 Step 6 

After the failure modes and their consequences have been surveyed, secondary effects are 
assessed. This assessment addresses the effects of failures that may create a hazard in a nearby 
component. For example, liquid air could drip from an uninsulated cold surface onto a brittle surface 
material at low temperature. Or liquid air could drip onto a material, such as asphalt, and create an 
explosive mixture. 

Use the Secondary Effects Worksheet (Figure 7) to evaluate the probability of the failure of one 
component having an effect on another component, subsystem, or region, and enter the results in 
column 17 of the Hazards Analysis Chart. 

Use the following ratings for the secondary effects analysis: 

R = further analysis of affected components required 
N = no further analysis needed. 

4.7.7 Step 7 

Next, a reaction effects assessment is performed and documented. This is an assessment of the 
effects if a component fails (that is, consider that the component does fail and assess what the results 
would be, regardless of the probability of it failing). This is useful for making a judgment on the safe 
use of a component. The reaction effects assessment would then help determine if the component 
may be safely used. The results of the reaction effects assessment should be entered into column 18 
of the Hazards Analysis Chart. 

The ratings given in Table 1 are used for the reaction effects assessment. 

4.8 Hydrogen Hazard Assessment Report 

The most benefit from a hydrogen hazards analysis is realized if the effort is properly documented 
from the beginning of the process. The report should include the following information: 

• Description of the system/equipment analyzed. 

• List of the team members and others who participated in the effort. 

• List of any assumptions that were made. 

• List of the standards and sources of information used. 

• Discussion of each step in the analysis procedure. 

• Description of the results of the analysis process. 

• Cross-sectional view of each component. 

• System fluid schematic. 

• Statement of any uncertainties, unknowns, concerns, limitations, stipulations of use, and any 
additional safety precautions. 
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• The recommendations and suggestions from the analysis, including any recommendations for 
further testing. 

• The completed Hazards Analysis Chart and all of the worksheets used in the analysis. 

5.0 Closing 

This procedure can be applied to the design and operation of hydrogen systems, and much can be 
learned from this process that could ultimately improve the public perception of hydrogen safety. 
Lessons to be learned include: how to better conduct the analysis, how to apply engineering judgment 
with limited combustion data, how to handle the effects of system complexity, and how to recognize 
and diffuse potentially divisive team roles. 

A hazards analysis, as described herein, provides design teams with a better understanding of their 
systems and gives system owners better knowledge of the risks and improved confidence in the 
system. System owners and design teams are much better prepared for higher-level reviews; in fact, 
analysis results may be directly transferred as preparation for subsequent reviews. Higher-level 
review teams appreciate and respect the rigor of this procedure. 

Resource requirements to conduct a hazards analysis using this procedure depend on system 
complexity. Current experience suggests that a single component requires approximately one day, but 
systems and facilities can take anywhere from a week to a month, depending on complexity. Complex 
systems require thorough advance preparation to keep the work group focused and working 
effectively. 

This guide conveys a flexible approach that can be applied to a variety of hydrogen systems at 
different levels, such as those described below: 

• Component level: valves, instrumentation, connectors, and tanks. 

• System level: fuel cells, electrolyzers, thrusters, storage systems, and transfer systems. 

• Facility level: test, storage, and dispensing facilities and remote or auxiliary power systems. 

This approach can be directly applied by industry to aid in the development of commercial and 
transportation hydrogen technologies. Hazards analysis results can be used to help prove code 
compliance and to ensure that liability issues have been addressed. This hydrogen hazards analysis may 
eventually become accepted as state of the art in liability cases. Further, it is suggested that development 
of a general hydrogen hazards analysis protocol be managed through a voluntary standards organization 
for ultimate use in the evaluation and certification of commercial hydrogen systems. 

The use of this guide to conduct hazards analyses of various hydrogen systems has shown the need 
for data that are not available, especially combustion and hydrogen embrittlement data. Specific 
inadequacies of basic combustion data have been identified, and more detailed ignition energy data 
are needed. Flammability limits vary with mixture composition, diluent presence, total pressure, and 
ignition source energy. While basic data exist for ambient conditions, more information is needed for 
hydrogen-oxygen-water and hydrogen-air-water mixtures at low and elevated pressures. Information 
is needed to evaluate electrolyzers in which failure modes could lead to hydrogen-oxygen-water vapor 
mixtures entrained in a two-phase bubbly-flow at pressures 2 to 3 times ambient temperature and 


11 



pressure. Corresponding data are also needed to evaluate detonation initiation. Finally, basic 
microgravity combustion data are needed for the aerospace community. 

Strategy is involved in completing those hazards analyses where incomplete combustion data or 
system familiarity challenge team members. Some examples are described below. 

• Attempt to bracket effects within regions or by thresholds discernible in the combustion data. 
Ignition sources may be considered in three energy regions: spurious static discharges (<1 J); 
those arising from an active device present in the system (10s to 100s of J); or explosive 
discharges (>1000 J). A sample consideration might be whether pressure limits preclude worry 
over spurious or spontaneous ignition. Our present understanding is that mixtures at sufficiently 
low pressure will not be ignited by weak ignition sources. 

• Attempt to identify “work-around logic.” Two simple examples are. 

- Specific ignition data are not available, but system design and operation at low pressure 
ensure there is no ignition source present. 

- If the mixture composition is unknown, be conservative and assume it to be stoichiometric. 

• In general, be conservative. For hydrogen, always assume some ignition mechanism is present. 
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Figure 1 

Procedure for Hydrogen Hazards Analysis 
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Figure 2 

Component/System Material Summary Worksheet 
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Figure 4 

Hydrogen Hazards Analysis Chart 
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Figure 5 

Causes Evaluated Worksheet 
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Figure 6 

Ignition Sources Worksheet 
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Figure 7 

Secondary Effects Worksheet 




Table 1 

Reaction Effect Assessment Rating and Criteria 
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Appendix A 


Code Requirements for Hydrogen Systems 



§ 1910.103 Hydrogen (Source: Code of Federal Regulations, Title 29 - Labor, Parts 1900 to 1910, 
U.S. Government Printing Office, Washington, 1993) 


(a) General 

(1) Definitions 

(i) Gaseous hydrogen system 

(ii) Approved 

(iii) Listed 

(iv) ASME 

(v) DOT Specifications 

(vi) DOT regulations 

(2) Scope 

(i) Gaseous hydrogen systems 

(a) facilities applied to 

( b ) facilities not applied to 

(ii) Liquefied hydrogen systems 

(a) facilities applied to 

(b) facilities not applied to 

(b) Gaseous hydrogen systems 

(1) Design 

(i) Containers 

(a) compliance requirements 

(1) ASME Boiler and Pressure Vessel Code 

(2) DOT Specifications and Regulations 

(b) supports for permanently installed containers 

(c) marking of portable container and manifolded supply unit 

(ii) Safety relief devices 

(a) as required by ASME BPVC or DOT Specifications and Regulations 

(b) arrangement of discharge 

(c) protection from frozen moisture) 

(iii) Piping, tubing, and fittings 

(a) suitable for hydrogen service, and temperature and pressure involved 

(b) conform to Section 2 — “Industrial Gas and Air Piping” — Code for 
Pressure Piping, ANSI B3 1.1-1967 with addenda B3 1.1-1969 

(c) acceptable joints, gaskets, and thread sealants 

(iv) Equipment assembly 

(a) components must be suitable for hydrogen service 

(b) supervision of installation 

(c) accessibility and protection of storage containers, piping, valves, 
regulating equipment and other accessories 

(d) ventilation of cabinets and housings containing hydrogen control or 
operating equipment 

( e ) secure mobile unit to prevent movement 

(f) electrical bonding of mobile supply units 

(v) Marking of hydrogen storage location 


REQUIREMENT 


ACTION 
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ACTION | REQUIREMENT 

(vi) Testing for gas tight at maximum operating pressure 

(2) Location 

(i) General 

(a) accessible to delivery equipment and to authorized personnel 
{b) shall be located above ground 

(c) shall not be located beneath electrical power lines 

(d) shall not be located close to flammable gas or liquid piping 

(e) location and dikes for storage near flammable liquid storage 

(ii) Specific requirements 

(a) order of preference for location 

(b) minimum separation distance to specified outdoor exposure 

(c) effect of fire wall on separation distance 

(d) location of systems of less than 3,000 CF 

(3) Design considerations at specific locations 

(i) Outdoor locations 

(a) noncombustible materials of construction for protective walls or roofs 

(b) ventilation where enclosing sides adjoin 

(c) electrical equipment within 1 5 ft 

(ii) Separate buildings 

(a) construction 

(b) ventilation to outdoors 

(c) explosion venting 

(d) elimination of ignition sources 

(e) electrical equipment for Class I, Division 2 locations 

(f) heating 

(iii) Special rooms 

(a) construction 

(b) ventilation to outdoors 

(c) explosion venting 

(d) elimination of ignition sources 

( e ) electrical equipment for Class I, Division 2 locations 
(/) heating 

(4) Operating instructions 

(5) Maintenance 

(c) Liquefied hydrogen systems 

(1) Design 

(i) Containers 

(a) comply with ASME BPVC or API 620 

(b) portable containers in accordance with DOT Specifications and 
Regulations 

(ii) Supports for permanently installed containers 

(iii) Marking of containers 

(iv) Safety relief devices 

(a) stationary and portable containers 

(i) stationary containers 


A-2 








ACTION 


REQUIREMENT 


(2) portable containers 

(■ b ) arrangement of discharge 

(c) protection from frozen moisture 

(d) protection of trapped volume between closures 

(v) Piping, tubing, and fittings 

(a) suitable for hydrogen service, pressures and temperatures involved, 
and thermal expansion and contraction 

(. b ) for GH 2 above -20 °F: conform to Section 2 — “Industrial Gas and 
Air Piping” — Code for Pressure Piping, ANSI B3 1. 1-1967 with 
addenda B3 1.1-1969; 

for GH 2 below -20 °F and for LH 2 : conform to 

Petroleum Refinery Piping ANSI B3 1.3-1966 or Refrigeration 

Piping ANSI B3 1.5-1966 with addenda B31.5a-1968 

(c) preferable joints 

(d) insulation of cold surfaces 

(e) surfaces beneath uninsulated cold surfaces dripping liquid air 

(vi) Equipment assembly 

(a) components must be suitable for LH 2 service and for pressures and 
temperatures involved 

(b) supervision of installation 

(c) accessibility and protection of storage containers, piping, valves, 
regulating equipment and other accessories; shutoff valve located in 
liquid product withdrawal lines 

(d) ventilation of cabinets and housings containing hydrogen control 
equipment 

(vii) Testing 

( a ) testing for gas-tight at operating pressure and temperature after 
installation 

( b ) inspection and testing of containers out of service more than 1 year 
(viii) Liquefied hydrogen vaporizers 

(a) anchors and flexibility 

(b) relief valve protection 

(c) heat source 

(d) low temperature shutoff switch 
(ix) Electrical systems 

( a ) Class I, Group B, Division 1 within 3 ft of point where connections 
regularly made and disconnected 

(. b ) Class I, Group B, Division 2 within 25 ft of point where connections 
regularly made and disconnected or within 25 ft of a LH 2 storage 
container; alternatives when equipment for Class I, Group B 
atmospheres not commercially available 
(x) Bonding and grounding 
(2) Location of LH 2 storage containers 
(i) General requirements 

( a ) accessible to mobile supply equipment at ground level and to 
authorized personnel 

(b) exposure to electrical power lines, flammable gas and liquid lines, or 
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ACTION 


REQUIREMENT 


lines carrying oxidizing materials 

(c) locate on ground higher than nearby above-ground flammable liquid 
storage or LOX storage 

(d) diking, diversion curbs, grading 

(e) fencing, posting, and placarding of storage sites 

(f) outdoor venting of safety relief devices for LH 2 located indoors 

(ii) Specific requirements 

(a) order of preference for location 

(b) minimum separation distance to specified exposure 

(iii) Handling of LH 2 inside buildings other than separate buildings and 
special rooms 

(3) Design considerations at specific locations 

(i) Outdoor locations 

(a) meaning; includes weather shelter or canopy 

(b) materials for surfaces beneath LH 2 lines from which liquid air 
can drip 

(c) construction of protective walls 

(d) electrical wiring and equipment compliance 

(e) lighting 

(ii) Separate buildings 

(a) construction 

(b) ventilation to outdoors 

(c) elimination of sources of ignition 

(d) electrical wiring and equipment compliance 

( e ) heating 

(iii) Special rooms 

(a) construction 

(b) ventilation to outdoors 

(c) explosion venting 

(d) elimination of sources of ignition 

(e) electrical wiring and equipment compliance 
(/) heating 

(4) Operating instructions 

(i) Written instructions 

(ii) Attendant 

(iii) Security 

(iv) Grounding 

(5) Maintenance 


A-4 







Appendix B 


Causes 



A discussion of relevant failure modes, applicable material properties, component/system operating 
considerations, design features, and control functions applicable for using the Causes Evaluated 
Worksheet (Figure 5) is given in this Appendix. 

Failure Modes 

Catastrophic failure modes include events with an accompanying rapid release of hydrogen (perhaps a 
large quantity) and/or fragments from the system, such as: 

• rupture 

• boiling liquid expanding vapor explosion (BLEVE) 

• liquid lockup 

• overpressurization 

Noncatastrophic failure modes include events that involve a slow release of hydrogen in which the 
quantity could be small. This could be the result of the use of unsuitable materials, or an 
incompatibility in material properties, for the operating environment. 

Material Properties 

Properties of the component materials to be considered include the following: 

Hydrogen Embrittlement. Evaluate the materials of each component for hydrogen embrittlement for 
all possible operating conditions, such as temperature, pressure, exposure time, stress state, and 
hydrogen purity. Some materials are more susceptible to hydrogen embrittlement than others, and 
some operating conditions promote hydrogen embrittlement more than others. 

Diffusion/Permeation. Hydrogen can diffuse through solid materials, especially some plastics. 
Hydrogen can diffuse through some metals at elevated temperatures, high pressure, or under an 
electrolytic driving force. 

Chemical Reaction. Hydrogen can form hydrides with many materials. This process generates heat 
and can change material properties. 

Temperature Compatibility. The low- and/or high-temperature compatibility/suitability of the 
materials for all components operating in an extreme temperature environment must be established. 

Ductility. Verify whether a ductile-to-brittle transition occurs. 

Thermal Expansion/Contraction. Establish that appropriate provisions for dimensional changes exist 
over the greatest temperature span that the material will experience. 

Thermal Gradients. Dimensional changes vary from one material to another and this must not create 
a failure during cool-down and/or warm-up. 

Expansion/Contraction. This may occur in a phase change (liquid to gas, for example). 

Ortho-Para Conversion. This will add heat to the system, which could increase vent rate or pressure 
buildup. 
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Operating Conditions 

Some operating conditions to be considered include the following: 

Adiabatic Compression. A quantity of any gas can generate a considerable amount of heat if rapidly 
compressed. This heat can cause distortion, or even melting, of polymers; and ignition of oxidizing 
contaminants such as air. Example: a downstream valve or flexible hose with a polymer liner in a 
dead-ended high-pressure hydrogen system. 

Particle Impact. Solid oxidizer particles such as sand, air, and oxygen in LH 2 impinging on materials 
may cause seat erosion or ignition in valves. 

Mechanical Stress or Vibration Internal to System Flow. Materials that are poor heat conductors, 
such as plastics, can reach their ignition temperature, causing them to soften and leak, when stressed 
or vibrated. Example: unanchored joints that protrude inside piping. 

Flow Regime. Stratified flow during cool-down; pressure and flow oscillations. 

Deformation. Changes from ambient to operating temperature can result in significant material 
changes in dimension, tolerance, and shape. This effect will be greater for some materials than others 
(metals vs. plastics, for example). The effect of thermal expansion/contraction in all components 
must be evaluated to determine if this condition could result in leakage (internally through a 
component such as a valve, or externally). Compatibility of dissimilar materials must be established. 
Example: stainless steel valve body with a plastic seat. 

Resonance. Acoustic oscillations within resonant cavities can cause a rapid gas temperature rise. The 
rise is more rapid and achieves higher values when particles are present. Ignition is not a concern in 
the absence of an oxidizer, but heat-distortion and/or melting of plastics is of concern. 

Thermal Acoustic Oscillation. 

Design and System Features 

Design and system features that should be evaluated include the following: 

• Evaluate the design features for venting hydrogen that reduce or eliminate the possibility of an 
unplanned ignition (sonic velocity at exit, backflow of air). 

• Check ventilation (keep hydrogen-air/oxygen mixtures below LFL; keep hydrogen from 
accumulating in a confined space). 

• Evaluate the design features for protection of the equipment/system from shock and vibration 
environments that could result in leakage. Stationary equipment/systems could be subjected to 
loading from an earthquake, for example. Mobile equipment/systems could be subjected to a 
variety of shock and vibration loads from roads (ground transportation), air turbulence (air 
transportation), and vibration from motors and engines. 

• Protect components/system from external damage (wrench dropped onto a component, for 
example). 

• Dewar ullage (prevent overfilling of dewar). 

• Check that failure of 2 components must occur to produce a hazardous situation. 

• Determine if there is adequate instrumentation for proper operation/safe conditions. 

• Check joints of redundant components (especially safety components). 
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• Boiloff. 

• Check pressure control (liquid-to-gas conversion; thermal expansion; regulator failure). 

• Check condensation [internal, exterior (on cold surfaces)]. 

• Check contamination concentration (air particles in filter in LH 2 system, sand particles, iron 
filings, weld slag, and soft good particles). 

• Purge hydrogen and air from system. 

• Minimize quantity stored and handled to minimize consequences of a hazard. 

• Hydrogen detection. 

• Fire detection. 

Administrative controls to mitigate or reduce hazards that should be evaluated include the following: 

• Approved operating procedures/checklists/emergency procedures. 

• Training plan. 

• Maintenance plan. 
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Appendix C 


Potential Ignition Sources 



A discussion of relevant ignition mechanisms applicable for using the Ignition Sources Worksheet 

(Figure 6) is given in this Appendix. Such ignition sources should be eliminated wherever possible. 

It is generally assumed that an ignition source will be present. 

Some potential ignition sources that should be evaluated are described below. 

Electrical Sources 

• Static discharge - Discharges of static electricity can produce high temperatures, often sufficient 
to cause a material to reach its ignition temperature. Example: the accumulation of electrostatic 
charges created by the friction of dry hydrogen flowing over, or through, nonmetals. 

• Electrical arc - Electrical arcs can provide the energy to ignite a combustible mixture of hydrogen 
and air/oxygen. 

• Charge accumulation - Electrical charge buildup is a function of electrical conductivity and 
dielectric strength parameters. Whether electrical charge buildup is a problem is a function of the 
relative rates of charge accumulation and charge dissipation within the flowing fluid. Electrical 
charge buildup is very small for flowing hydrogen, including liquid hydrogen, but solid particles 
in the flow could greatly increase its buildup. The type of particle (oxygen, nitrogen, hydrogen, 
sand, metal) could be important. Buildup of electrical charge could cause a spark that could result 
in an ignition of a combustible mixture of hydrogen and air/oxygen. 

• Electrical short circuits, sparks, and arcs. 

• Static electricity (two-phase flow). 

• Static electricity (flow with solid particles). 

• Lightning. 

• Electrical charge generated by equipment operation. 

Mechanical Sources 

• Mechanical impact. 

• Friction and galling. 

• Metal fracture. 

• T ensile rapture. 

• Mechanical vibration. 

Thermal Sources 

• Open flames. 

• Hot surfaces. 

• Personnel smoking. 

• Welding. 

• Exhaust from thermal combustion engine. 

• Explosive charges. 

• Resonance ignition (repeated shock waves in a flow system). 

• Heating by high-velocity jets. 

• Shock waves from tank rapture. 

• Fragments from bursting vessels. 
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